PDF / .VIR static analysis report

Static analysis result for SHA-256 000af8fbf7b77f0d…

CLEAN

PDF / .VIR

5.31 MB Created: 2025-11-24 19:43:51 -05:00 Authoring application: Microsoft® Excel® para Microsoft 365 First seen: 2025-11-28
MD5: 382bac8db9870819b9767962f6e5cd7f SHA-1: 7e41174bc1370c71452ddcfe581acb65ab8daa50 SHA-256: 000af8fbf7b77f0d0684e1342dc38ccb3e57ace319ce56523e98c2113630b3ba
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0168

Heuristics 2

  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser timed out. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wwww.microsoft.com0 In extracted file (stream_202_off002bbed8.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (stream_202_off002bbed8.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_202_off002bbed8.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_202_off002bbed8.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_202_off002bbed8.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_202_off002bbed8.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_202_off002bbed8.bin)
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_202_off002bbed8.bin)
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn extracted file (stream_202_off002bbed8.bin)
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In extracted file (stream_202_off002bbed8.bin)
    • http://www.microsoft.com/typography/fonts/In extracted file (font_00_sfnt_off002b1f1e.bin)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off000027ce.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x27CE 70278 bytes
SHA-256: 72a706e02d6787ff0606d4154beb9c3e2b2b2d2a3b1665e0114a44493be84cfc
stream_002_off0000416b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x416B 72891 bytes
SHA-256: 3a49d9850d7529b22dfb579fc6f046c68235db26d158cf6ffc41182274134cc1
stream_003_off00005c65.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5C65 71391 bytes
SHA-256: e5ebc22e294504e55262fe252bf59c1357248d57026e19e468b70221d64c3a82
stream_004_off000076d9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x76D9 71074 bytes
SHA-256: 5ce9fdf752123bdbfabd3ce8f49acb8e0d9c9582b786113a77fa61080506d3a4
stream_005_off00008e51.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8E51 70575 bytes
SHA-256: c6f0a758c00584210ea3ab6bdbaf9215eaf80d133237ab6b3cf0e98b0bf43d37
stream_006_off0000a7ef.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA7EF 71276 bytes
SHA-256: 6e51db4010f088abb6020e5fba9ee8c861033cae1f8d309e904ccfb35c41a1d5
stream_007_off0000bf26.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBF26 72889 bytes
SHA-256: 10cb53db5f5873cc7a627a8ba015de6dd1f2c5dbbb41bf5901123725d5508cb7
stream_008_off0000d94e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD94E 74523 bytes
SHA-256: 3b51b7f7dfb5b2ff0216c7ab01651fb2b6ca1d700d0fa21edf3e763dcd6d567d
stream_009_off0000f2a1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF2A1 72371 bytes
SHA-256: 3cd83af5028346ebfa799000863f57b4433a5b52553e193cafdc15d990c07ac7
stream_010_off00010c60.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10C60 71031 bytes
SHA-256: f6119848c56c7af7e0811d0accb24dcb1f8798335318e5f01e506efde8e9e0ed
stream_011_off0001259e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1259E 72051 bytes
SHA-256: ad3650ec0bea530125488edac122d96f4bf0d67bf150a58cde293a9b83c47acf
stream_012_off00013f52.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13F52 72252 bytes
SHA-256: b86ef7e5be1015033f5c62b3da32aca631b8028583deddf78acac05e36d2587b
stream_013_off00015795.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15795 70712 bytes
SHA-256: 3377ec55f4015901e9ddbacc0153cef6e86a431e752c0983cce054c8c7f9abd0
stream_014_off00016f19.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16F19 71831 bytes
SHA-256: 2544dbefd0c4695d41e6a8f5526f6938b7c4ca938a0f68a07867ab2b3c0144a3
stream_015_off00018906.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18906 73240 bytes
SHA-256: f47e5383e7d91a8301ea4d8f282bee60cfb5dc8cbf744213b8478f0fe2732f51
stream_016_off0001a18f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A18F 72454 bytes
SHA-256: 57910c3be1de6bead3a10bae571311e30bd7db23f2385fbe75b5de8576507f65
stream_017_off0001bc6e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BC6E 71105 bytes
SHA-256: 0af1addd5c3ac3c47c7db54593076c45bb654839e1db941dde94de83db39cc40
stream_018_off0001d5db.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D5DB 71595 bytes
SHA-256: d274da2344599effa64e3f6cb445a6c2d596b288fb8798e8d794a1ff4ab4cb28
stream_019_off0001f065.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1F065 72285 bytes
SHA-256: 4c22e0d3ec8c85f38a962faa4b54663dff17e360152c7af52bfa7875a3091e5e
stream_202_off002bbed8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2BBED8 115328 bytes
SHA-256: ec170bd19cfa391df22de0464d1c04a75ab793a9ddd8776652a1952c2dcd145c
font_00_sfnt_off002b1f1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B1F1E 36172 bytes
SHA-256: 30b73a1341f246f0fca722ca29fda8358b0064ce807b0b2c3d7ae405b9c65b85
font_01_sfnt_off002b6d2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B6D2E 38536 bytes
SHA-256: 2f6635f070979f10320200b5a959bcd3cfffbfc8f600a0e2f8009e9fb68ec3d2

Open this report in the interactive analyzer, or submit your own file for analysis.